@newrelic/security-agent 2.0.0 → 2.1.1

package/lib/instrumentation-security/hooks/restify/nr-restify.js

@@ -66,17 +66,17 @@ function initialize(shim, mod, moduleName) {
  * @param {*} req 
  */
 function extractParams(shim, req) {
-    const segment = shim.getActiveSegment();
-    if (segment && segment.transaction) {
+    const transaction = shim.tracer.getTransaction(); 
+    if (transaction) {
 
-        let request = requestManager.getRequestFromId(segment.transaction.id);
+        let request = requestManager.getRequestFromId(transaction.id);
         if (req.params && request) {
             try {
                 Object.keys(req.params).forEach(function (key) {
                     if (req.params[key]) {
                         if (!request.parameterMap[key]) {
                             request.parameterMap[key] = new Array(req.params[key].toString());
-                            requestManager.setRequest(segment.transaction.id, request);
+                            requestManager.setRequest(transaction.id, request);
                         }
                     }
                 });
@@ -91,7 +91,7 @@ function extractParams(shim, req) {
                 Object.keys(query).forEach(function (key) {
                     if (query[key]) {
                         request.parameterMap[key] = new Array(query[key].toString());
-                        requestManager.setRequest(segment.transaction.id, request);
+                        requestManager.setRequest(transaction.id, request);
                     }
                 });
             } catch (error) {
@@ -100,7 +100,7 @@ function extractParams(shim, req) {
         }
         if (req.route && req.route.path && request) {
             request.uri = req.route.path;
-            requestManager.setRequest(segment.transaction.id, request);
+            requestManager.setRequest(transaction.id, request);
         }
     }
-}
+}

package/lib/instrumentation-security/hooks/undici/nr-undici.js

@@ -24,6 +24,10 @@ const url = require('url');
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf){
+    logger.warn('ssrf detection is disabled');
+    return;
+  }
   logger.info('Instrumenting ' + moduleName);
   fetchHook(shim, mod, "fetch");
   let util = shim.require('./lib/core/util');

package/lib/instrumentation-security/hooks/xpath/nr-xpath.js

@@ -19,6 +19,10 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName){
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.xpath_injection){
+    logger.warn('xpath_injection detection is disabled');
+    return;
+  }
  logger.info('Instrumenting '+ moduleName)
 
   if(moduleName==='xpath'){

package/lib/nr-security-agent/index.js

@@ -17,7 +17,7 @@ const njsAgentConstants = require('./lib/core/sec-agent-constants');
 const NRLogger = API.newrelic.shim.logger.child({ component: 'security-agent' });
 NRLogger.info("Starting New Relic Node.js Security Agent ");
 try {
-    if (NRAgent.config.security.enabled){
+    if (NRAgent.config.security.enabled) {
         require('../instrumentation-security');
     }
 } catch (error) {
@@ -117,11 +117,44 @@ function initialize() {
     if (NRAgent) {
         NRAgent.on('started', () => {
             NRLogger.info("Started New Relic Node.js Security Agent");
+            logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
+            if (Agent.getAgent().status.getStatus() != 'connecting') {
+                Agent.getAgent().delayed = false;
+                wsClient.obeyReconnect();
+                return;
+            }
             if (NRAgent.config.security.enabled || !NRAgent.config.high_security) {
-                wsClient.initialize();
-                logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
-                Agent.getAgent().status.setStatus('connecting');
-                Agent.setNRAgent(NRAgent);
+                let delayFromConfig = parseInt(NRAgent.config.security.scan_schedule.delay);
+                let delay = delayFromConfig;
+                if (isNaN(delay) || delay < 0) {
+                    delay = 0;
+                }
+                NRAgent.config.security.scan_schedule.delay = delay;
+                const allowSampling = NRAgent.config.security.scan_schedule.always_sample_traces;
+
+                if (delay >= 0) {
+                    logger.debug("IAST delay is set to:", delay);
+                    logger.info("Security Agent delay scan time is set to:", commonUtils.getScheduledScanTime(delay))
+                    Agent.getAgent().delayed = true;
+                    setTimeout(() => {
+                        Agent.getAgent().delayed = false;
+                        logger.info("IAST scanning delay of %s minutes over", delay);
+                        commonUtils.honourDurationConfiguration();
+                        commonUtils.executeCronSchedule();
+                        if (!allowSampling) {
+                            wsClient.initialize();
+                            Agent.getAgent().status.setStatus('connecting');
+                            Agent.setNRAgent(NRAgent);
+                        }
+                    }, delay * 60000);
+                }
+                logger.info("Security Agent is running with config:", JSON.stringify(NRAgent.config.security));
+                if (allowSampling) {
+                    wsClient.initialize();
+                    Agent.getAgent().status.setStatus('connecting');
+                    Agent.setNRAgent(NRAgent);
+                }
+                
             }
             else {
                 logger.warn("security.enabled flag is set to false");

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -11,6 +11,7 @@ const logger = logs.getLogger();
 const initLogger = logs.getInitLogger();
 const LinkingMetaData = require('./LinkingMetadata');
 const LogMessage = require('./LogMessage');
+const lodash = require('lodash');
 
 
 /* eslint-disable camelcase */
@@ -37,6 +38,22 @@ function AuthHeaders() {
         authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
         authHeaders['NR-CSEC-ENTITY-NAME'] = metadata['entity.name'] ? metadata['entity.name'] : '';
         authHeaders['NR-CSEC-ENTITY-GUID'] = metadata['entity.guid'] ? metadata['entity.guid'] : '';
+        let instanceCount = parseInt(NRAgent.config.security.scan_controllers.scan_instance_count);
+        if (isNaN(instanceCount)) {
+            instanceCount = 0;
+        }
+        if (instanceCount < 0 || instanceCount > 1) {
+            instanceCount = 0;
+        }
+        authHeaders['NR-CSEC-IAST-SCAN-INSTANCE-COUNT'] = instanceCount ? instanceCount : 0
+        if ((NRAgent.config.security.iast_test_identifier && !lodash.isEmpty(NRAgent.config.security.iast_test_identifier)) || process.env.NEW_RELIC_SECURITY_IAST_TEST_IDENTIFIER) {
+            let iast_test_identifier = NRAgent.config.security.iast_test_identifier || process.env.NEW_RELIC_SECURITY_IAST_TEST_IDENTIFIER
+            authHeaders['NR-CSEC-IAST-TEST-IDENTIFIER'] = iast_test_identifier;
+            logger.debug("iast_test_identifier is:", iast_test_identifier);
+            authHeaders['NR-CSEC-IAST-SCAN-INSTANCE-COUNT'] = 1;
+        }
+        authHeaders['NR-CSEC-PROCESS-START-TIME'] = Date.now() - Math.floor(process.uptime() * 1000);
+        authHeaders['NR-CSEC-IGNORED-VUL-CATEGORIES'] = commonUtils.listSkipDetectionCategory();
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
         const logMessage = new LogMessage.logMessage("SEVERE", 'Exception in preparing auth headers', __filename, error);
@@ -76,6 +93,8 @@ function getInstance() {
     return authHeaders;
 }
 
+
+
 module.exports = {
     getInstance
 };

package/lib/nr-security-agent/lib/core/ExceptionReporting.js

@@ -89,6 +89,7 @@ function exceptionReporting(exception, request, responseCode) {
         this.timestamp = Date.now();
         this.httpRequest = request;
         this.httpRequest.route = request.uri ? request.uri : request.url;
+        this.httpRequest.requestURI = request.url.split('?')[0];
         this.exception = null;
         this.counter = 1;
         this.responseCode = responseCode ? responseCode : null

package/lib/nr-security-agent/lib/core/agent.js

@@ -42,6 +42,7 @@ function Agent(applicationInfo, logger, client, status) {
     this.logger = logger;
     this.status = status;
     this.wsStatus = 0;
+    this.delayed = false;
 }
 
 Agent.prototype = {};
@@ -96,6 +97,7 @@ Agent.prototype.setAgentStatus = function setAgentStatus(status) {
     Agent.eventEmitter.emit(EVENTS.AGENT_STATUS_UPDATED_EVENT, status);
 };
 
+
 Agent.EVENTS = EVENTS;
 
 Agent.eventEmitter = new EventEmitter();
@@ -138,6 +140,7 @@ Agent.setNRAgent = function setNRAgent(agent) {
     }
 };
 
+
 module.exports = {
     Agent
 };

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -23,6 +23,23 @@ let websocketHealth;
 
 const ringBuffer = require('ringbufferjs');
 const bufferedLogEvents = new ringBuffer(10);
+const { CronJob } = require('cron');
+let scanStartTime = 0;
+let trafficStartedTime = 0;
+const cron = require('cron');
+
+const skip_detection_category_map = {
+    insecure_settings: ['CRYPTO', 'HASH', 'RANDOM', 'SECURE_COOKIE', 'TRUSTBOUNDARY'],
+    invalid_file_access: ['FILE_OPERATION', 'FILE_INTEGRITY'],
+    sql_injection: ['SQL_DB_COMMAND'],
+    nosql_injection: ['NOSQL_DB_COMMAND'],
+    ldap_injection: ['LDAP'],
+    javascript_injection: ['JS_INJECTION'],
+    command_injection: ['SYSTEM_COMMAND'],
+    xpath_injection: ['XPATH'],
+    ssrf: ['HTTP_REQUEST'],
+    rxss: ['REFLECTED_XSS']
+}
 
 
 /**
@@ -271,7 +288,7 @@ function removeOlderlogfiles() {
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
         let maxLogfile = process.env.NR_CSEC_DEBUG_LOGFILE_MAX_COUNT;
-        if(isNaN(maxLogfile)){
+        if (isNaN(maxLogfile)) {
             maxLogfile = 2;
         }
         for (let i = maxLogfile; i < sorted.length; i++) {
@@ -409,7 +426,7 @@ function addLogEventtoBuffer(logMessage) {
  * Utility to get framework from APM
  * @returns 
  */
-function getFramework(){
+function getFramework() {
     let framework = EMPTY_STR;
     try {
         framework = NRAgent.environment.get('Framework')[0];
@@ -419,14 +436,119 @@ function getFramework(){
     return framework;
 }
 
+function listSkipDetectionCategory() {
+    let skipList = [];
+    try {
+        let skipCataegories = NRAgent.config.security.exclude_from_iast_scan.iast_detection_category;
+        for (const key in skipCataegories) {
+            if (skipCataegories[key]) {
+                skipList = skipList.concat(skip_detection_category_map[key]);
+            }
+        }
+    } catch (error) {
+        logger.error("Error while processing skip detection categories:", error);
+    }
+    return skipList;
+}
+
+function refreshAgent() {
+    const { Agent } = require('./agent');
+    if (Agent.getAgent().status.getStatus() == 'disabled' || Agent.getAgent().delayed) {
+        Agent.getAgent().delayed = false;
+        const wsClient = Agent.getAgent().client;
+        Agent.getAgent().status.setStatus('connecting');
+        wsClient.obeyReconnect();
+        honourDurationConfiguration();
+    }
+}
+
+function executeCronSchedule() {
+    try {
+        let schedule = NRAgent.config.security.scan_schedule.schedule;
+        if (lodash.isEmpty(schedule)) {
+            return;
+        }
+        logger.debug("Schedule config is set to:", schedule);
+        schedule = schedule.replace(/\?/g, '*');
+        logger.info("Security Agent scheduled time is set to:", getScheduledScanTime(Math.ceil(cron.timeout(schedule) / 60000)))
+        const job = new cron.CronJob(
+            schedule, // cronTime
+            function () {
+                logger.debug('Cron schedule invoked');
+                logger.info("Security Agent scheduled time is set to:", getScheduledScanTime(Math.ceil(cron.timeout(schedule) / 60000)))
+                refreshAgent()
+            }, // onTick
+            null, // onComplete
+            true, // start
+        );
+    } catch (error) {
+        logger.error("Error while processing schedule. Please check schedule cron expression", error);
+        shutDownAgent();
+    }
+
+}
+
+function honourDurationConfiguration() {
+    let durationFromConfig = parseInt(NRAgent.config.security.scan_schedule.duration);
+    let duration = durationFromConfig;
+    if (isNaN(duration) || duration < 0) {
+        duration = 0;
+    }
+    logger.debug("IAST duration is set to:", duration);
+    NRAgent.config.security.scan_schedule.duration = duration;
+    if (duration < 1) {
+        return;
+    }
+    logger.info("Security Agent shutdown is set to:", getScheduledScanTime(duration))
+    setTimeout(() => {
+        shutDownAgent();
+    }, duration * 60000);
+}
 /**
  * Utility to send error to error inbox of APM
  * @param {*} error 
  */
-function sendErrorToErrorInbox(error){
+function sendErrorToErrorInbox(error) {
     API.newrelic.noticeError(error);
 }
 
+const getScheduledScanTime = (delayInMinutes) => {
+    // Get the current time
+    const currentTime = new Date();
+
+    // Add the given minutes to the current time
+    currentTime.setMinutes(currentTime.getMinutes() + delayInMinutes);
+
+    const year = currentTime.getFullYear();
+    const month = currentTime.toLocaleString("default", { month: "long" });
+    const day = currentTime.toLocaleString("default", { weekday: "long" });
+    const date = currentTime.getDate();
+    const hours = currentTime.getHours();
+    const minutes = currentTime.getMinutes();
+    const seconds = currentTime.getSeconds();
+    const futureUpdatedTime = `${hours.toString().padStart(2, "0")}:${minutes.toString().padStart(2, "0")}:${seconds.toString().padStart(2, "0")}`;
+    const futureDateTime = `${day}, ${month} ${date} ${year} ${futureUpdatedTime}`;
+    return futureDateTime
+};
+
+function shutDownAgent() {
+    const { Agent } = require('./agent');
+    if (NRAgent.config.security.scan_schedule.always_sample_traces) {
+        Agent.getAgent().delayed = true;
+        logger.warn('Scan duration completed, IAST going under hibernate mode')
+        return;
+    }
+    if (Agent.getAgent().status.getStatus() === 'disabled') {
+        return;
+    }
+    Agent.getAgent().status.setStatus('disabled');
+    const wsClient = Agent.getAgent().client;
+    wsClient.closeWS();
+    logger.warn("Security Agent status is disabled");
+}
+
+
+
 
 module.exports = {
     getUUID,
@@ -452,5 +574,11 @@ module.exports = {
     addLogEventtoBuffer,
     getLogEvents,
     getFramework,
-    sendErrorToErrorInbox
+    listSkipDetectionCategory,
+    executeCronSchedule,
+    honourDurationConfiguration,
+    scanStartTime,
+    trafficStartedTime,
+    sendErrorToErrorInbox,
+    getScheduledScanTime,
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -6,8 +6,13 @@ const { Agent } = require('../../../agent');
 let pendingRequestIds = new Set();
 let completedRequestsMap = new Map();
 const PolicyManager = require('../../../Policy');
+const API = require('../../../../../../nr-security-api');
 let batchSize;
-const batchthreshold = 160;
+const batchthreshold = 200;
+const logs = require('../../../logging');
+let logger = logs.getLogger();
+const commonUtils = require('../../../commonUtils');
+
 function getPendingRequestIds() {
     return [...pendingRequestIds];
 }
@@ -56,6 +61,7 @@ function IASTCleanup() {
 }
 
 function generateIASTDataRequest() {
+
     const policyInstance = PolicyManager.getInstance();
     if (policyInstance.data && policyInstance.data.vulnerabilityScan && policyInstance.data.vulnerabilityScan.iastScan) {
         batchSize = batchSize ? batchSize : policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
@@ -64,13 +70,33 @@ function generateIASTDataRequest() {
         }
     }
     if (getCompletedRequestsMap().size >= batchSize || batchSize < batchthreshold || getPendingRequestIds().length < batchSize) {
-        batchSize = (2 * batchSize);
+        batchSize = (2 * batchSize) - getPendingRequestIds().length;
+    }
+
+    const NRAgent = API.getNRAgent();
+    let scanRateLimit = 3600;
+    let scanRateLimitFromConfig = parseInt(NRAgent.config.security.scan_controllers.iast_scan_request_rate_limit);
+    scanRateLimit = scanRateLimitFromConfig
+    if (isNaN(scanRateLimitFromConfig)) {
+        scanRateLimit = 3600;
     }
+    if (scanRateLimit >= 0 || scanRateLimit < 0) {
+        batchSize = parseInt(scanRateLimit / 12);
+        if (scanRateLimit < 12) {
+            batchSize = 1;
+        } else if (scanRateLimit > 3600) {
+            batchSize = 300;
+        }
+    }
+
     let object = {};
     object['jsonName'] = 'iast-data-request';
     object['applicationUUID'] = Agent.getAgent().applicationInfo.applicationUUID;
     object['appEntityGuid'] = Agent.getAgent().applicationInfo.appEntityGuid;
     object['appAccountId'] = Agent.getAgent().applicationInfo.appAccountId;
+    if (batchSize && batchSize > 100) {
+        batchSize = 100;
+    }
     object["batchSize"] = batchSize ? batchSize : 300;
     object['pendingRequestIds'] = getPendingRequestIds();
     object['completedRequests'] = Object.fromEntries(getCompletedRequestsMap());

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -24,6 +24,9 @@ const PolicyManager = require('../../../Policy');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
+const commonUtils = require('../../../commonUtils');
+
+const CSEC_HOME_TMP_CONST_ENCODED = new RegExp('%7B%7BNR_CSEC_VALIDATOR_HOME_TMP%7D%7D', 'g');
 
 let logger;
 let lastFuzzEventTime = 0;
@@ -31,13 +34,26 @@ let iastIntervalConst;
 let coolDownIntervalConst;
 let additionalCoolDownTime = 0;
 let fuzzedApiIDSet = new Set();
+const API = require('../../../../../../nr-security-api');
+const NRAgent = API.getNRAgent();
 
 
 /**
  * utility to start IAST Schedular
  */
 function startIASTSchedular() {
-    Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    if (Agent.getAgent().delayed) {
+        let delayFromConfig = parseInt(NRAgent.config.security.scan_schedule.delay);
+        let delay = delayFromConfig;
+        if (isNaN(delay) || delay < 0) {
+            delay = 0;
+        }
+        // logger.debug("IAST data pull request is scheduled at %s", require('../../../commonUtils').getScheduledScanTime(delay))
+    }
+    if (!Agent.getAgent().delayed) {
+        Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    }
+
     if (iastIntervalConst) {
         clearInterval(iastIntervalConst);
     }
@@ -50,8 +66,11 @@ function startIASTSchedular() {
     if (isNaN(probingInterval)) {
         probingInterval = 5;
     }
-    
+
     iastIntervalConst = setInterval(() => {
+        if (Agent.getAgent().status.getStatus() == 'disabled' || Agent.getAgent().delayed) {
+            return;
+        }
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
         let completedListSize = IASTUtil.getCompletedRequestsMap().size;
@@ -86,9 +105,19 @@ function logScannedApiId(fuzzHeader, requestURL) {
 
 // handler function to parse fuzz event and prepare fuzz request
 function handler(json) {
+    if (Agent.getAgent().status.getStatus() == 'disabled') {
+        return;
+    }
     setLastFuzzEventTime();
     let rawFuzzRequest = json.arguments[0];
-    rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
+
+    try {
+        rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
+        rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST_ENCODED, encodeURI(CSEC_HOME_TMP));
+    } catch (error) {
+        logger.debug("Error while replacing place holder", error);
+    }
+
     let fuzzRequest;
     try {
         fuzzRequest = JSON.parse(rawFuzzRequest);
@@ -96,7 +125,7 @@ function handler(json) {
         IASTUtil.addPendingRequestId(json.id);
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
-        
+
         const logMessage = new LogMessage.logMessage(SEVERE, 'Parsing exeception in fuzz request', __filename, error);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
     }
@@ -177,6 +206,9 @@ function handleFuzzResponse(response, fuzzDetails) {
     const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
     if (response) {
         IASTUtil.removePendingRequestId(fuzzRequest.id);
+        if (commonUtils.scanStartTime == 0) {
+            commonUtils.scanStartTime = Date.now();
+        }
         response.then(() => {
             logger.info('Fuzz success: ' + rawFuzzRequest);
         }).catch(() => {

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -10,6 +10,10 @@ const initLogger = logs.getInitLogger();
 const LOG_MESSAGES = require('../../../sec-agent-constants').LOG_MESSAGES;
 const applicationInfoModule = require('../../../applicationinfo');
 const LogMessage = require('../../../LogMessage');
+const API = require('../../../../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+const { Agent } = require('../../../agent');
+
 
 module.exports.handler = function handler(json) {
     try {
@@ -20,7 +24,7 @@ module.exports.handler = function handler(json) {
         initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
         const logMessage = new LogMessage.logMessage("INFO", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
-
+       
     } catch (error) {
         logger.error(LOG_MESSAGES.PARSING_EXP_WELCOME_MSG, error);
     }

package/lib/nr-security-agent/lib/core/connections/websocket/response/ws-reconnect.js

@@ -4,11 +4,14 @@
  */
 
 let logger;
+const { Agent } = require('../../../agent');
 module.exports.handler = function handler (json) {
-    logger.info('WS reconnect received', json);
-    const { Agent } = require('../../../agent');
-    const wsClient = Agent.getAgent().client;
-    wsClient.obeyReconnect();
+    if (Agent.getAgent().status.getStatus() != 'disabled'){
+        logger.info('WS reconnect received', json);
+        const wsClient = Agent.getAgent().client;
+        wsClient.obeyReconnect();
+    }
+    
 };
 
 module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -176,6 +176,9 @@ SecWebSocket.prototype.reconnect = function reconnect() {
 };
 
 SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
+    if (Agent.getAgent().status.getStatus() == 'disabled') {
+        return;
+    }
     const { instance } = this;
     if (initTimeOut) {
         clearTimeout(initTimeOut);
@@ -194,13 +197,25 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
 
 }
 
+SecWebSocket.prototype.closeWS = function closeWS() {
+    const { instance } = this;
+    try {
+        instance.close();
+    } catch (error) {
+        logger.error("Error while closing websocket", error);
+    }
+}
+
 SecWebSocket.prototype.pingWS = async function pingWS() {
+    if (Agent.getAgent().status.getStatus() != 'active') {
+        return;
+    }
     const self = this;
     let currentTime = Date.now();
 
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
-    logger.debug("Websocket ready state is:",self.instance.readyState)
-    
+    logger.debug("Websocket ready state is:", self.instance.readyState)
+
     if (timeDiffInPing > 40 && lastPongtime != 0 && self.instance.readyState > 1) {
         self.obeyReconnect();
         lastPongtime = 0;

package/lib/nr-security-agent/lib/core/health-check.js

@@ -14,7 +14,8 @@ const NODE_JS_LITERAL = 'Node.js:';
 
 let NODE_SERVER;
 let instance;
-let logger;
+const logs = require('./logging');
+let logger = logs.getLogger();
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 
@@ -35,6 +36,7 @@ module.exports.getInstance = function () {
     return instance;
 };
 
+
 /**
  * Creates a new HealthCheck object.
  *
@@ -63,6 +65,9 @@ function HC(info) {
     this.iastEventStats = EventStats.getInstance();
     this.raspEventStats = EventStats.getInstance();
     this.exitEventStats = EventStats.getInstance();
+    this.scanStartTime =  require('./commonUtils').scanStartTime;
+    this.trafficStartedTime = require('./commonUtils').trafficStartedTime;
+    this.procStartTime = Date.now() - Math.floor(process.uptime() * 1000);
 
 
     /**

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -134,6 +134,7 @@ function generateSecEvent(securityMetadata) {
         const isAPIBlocked = false;
         const event = new SecEvent(traceObject.sourceDetails.fileName, traceObject.sourceDetails.funcName, traceObject.sourceDetails.lineNumber, securityMetadata.interceptedArgs, securityMetadata.executionId, agentModule.applicationInfo, securityMetadata.request, securityMetadata.eventType, traceObject.sourceDetails.source, securityMetadata.eventCategory, metaData, stakTrace, apiId, isAPIBlocked);
         event.metaData.isClientDetectedFromXFF = isClientDetectedFromXFF;
+        event.metaData.skipScanParameters = NRAgent.config.security.exclude_from_iast_scan.http_request_parameters;
         event.httpRequest.route = uri;
         return event;
     } catch (e) {
@@ -191,9 +192,12 @@ function generateExitEvent(secEvent) {
 
 function sendEvent(secEvent) {
     const agentModule = Agent.getAgent();
-    if (agentModule.status.getStatus() != 'connecting' && NRAgent.config.security.enabled) {
+    if (agentModule.status.getStatus() != 'connecting' && NRAgent.config.security.enabled && agentModule.status.getStatus() == 'active') {
         agentModule.client.dispatcher(secEvent);
         if (!firstEventSent && agentModule.status.getStatus() === 'active') {
+            if(commonUtils.trafficStartedTime == 0){
+                commonUtils.trafficStartedTime = Date.now();
+            }
             initLogger.info("[STEP-8] => First event sent for validation. Security Agent started successfully", JSON.stringify(secEvent));
             firstEventSent = true;
         }